Privacy Legislation Amendment Act 2006

Overview

The Privacy Legislation Amendment Act 2006, enacted by the Parliament of Australia, addresses the need to enhance privacy protections for sensitive health and genetic information. The Act amends the Privacy Act 1988 to clarify and strengthen the authorisation of the collection of health information disclosed to organisations under specific health laws. It also introduces provisions to define genetic information and its implications, ensuring that such information is appropriately protected under the Act. Furthermore, the Act allows the Privacy Commissioner to approve guidelines for the use and disclosure of genetic information, particularly in circumstances where there is a serious threat to the health or safety of an individual's genetic relatives. The overarching policy objective is to balance the protection of personal privacy with the needs of public health and medical research.

Scope and Application

The Privacy Legislation Amendment Act 2006 (No. 99, 2006) amends existing privacy laws to enhance the protection of certain health and genetic information. It applies to organisations, including those regulated under the National Health Act 1953, and entities handling health information, particularly where such information is disclosed under a health law. The amendments extend the legal authorisation for the collection of health information by organisations when the disclosure is authorised by or under a health law. Furthermore, the Act expands the definition of health information to include genetic information that is predictive of the health of an individual or a genetic relative, thereby broadening the scope of information covered under the Privacy Act 1988. The Commissioner for Privacy is empowered to approve guidelines issued by the National Health and Medical Research Council for the use and disclosure of genetic information, particularly in contexts where there is a serious threat to the life, health, or safety of a genetic relative. These guidelines can be reviewed by the Administrative Appeals Tribunal. The Act's jurisdictional reach is at the Commonwealth level, affecting entities and individuals across Australia subject to the Privacy Act 1988.

Key Provisions

The Privacy Legislation Amendment Act 2006 (No. 99, 2006) introduces significant changes to the privacy protection of health and genetic information under Australian law. The Act amends the National Health Act 1953 and the Privacy Act 1988 to enhance privacy protections for sensitive health and genetic information. Under section 135AC of the National Health Act 1953, the Act provides that if health information is disclosed to an organisation and the disclosure is authorised by or under a health law, the collection of the information by the organisation is taken to be authorised by or under law for the purposes of National Privacy Principle 10 in Schedule 3 to the Privacy Act 1988. This amendment is intended to clarify the legal basis for the collection of health information in certain circumstances. The Privacy Act 1988 is also amended to expand the definitions of health information and sensitive information to include genetic information. The Act introduces a new definition of 'genetic relative' to clarify the scope of genetic information covered by the Act. Additionally, the Act allows the Privacy Commissioner to approve guidelines issued by the National Health and Medical Research Council for the use and disclosure of genetic information, which can help protect the privacy of genetic information while allowing for necessary disclosures to prevent serious threats to health or safety. This amendment is designed to strike a balance between privacy protections and the need to share sensitive information in specific circumstances. The Act imposes obligations on organisations handling health and genetic information to ensure that any collection, use, or disclosure of such information complies with the amended National Privacy Principles. Organisations must ensure that any disclosure of health information is authorised by or under a health law and that any use or disclosure of genetic information complies with the guidelines approved by the Privacy Commissioner. Additionally, organisations must take reasonable steps to protect the privacy of the individuals whose information they handle. Failure to comply with these obligations may result in civil or criminal penalties. The Privacy Legislation Amendment Act 2006 also introduces potential consequences for breaches of the amended privacy provisions. While the Act does not specify maximum penalties for breaches, it is likely that penalties would be consistent with those provided under the Privacy Act 1988. For individuals, unauthorised collection, use, or disclosure of health or genetic information may result in civil penalties of up to $2,100,000 for a corporation and $210,000 for an individual. Criminal penalties may also apply for serious or repeated breaches, with maximum penalties of up to 10 years imprisonment for individuals and $5.25 million for corporations. The Act also allows for review of decisions by the Privacy Commissioner by the Administrative Appeals Tribunal, providing a mechanism for organisations to challenge decisions that may affect their compliance with the Act.